Merge branch 'mluds-master' into master

No issue #

Arvados-DCO-1.1-Signed-off-by: Ward Vandewege <ward@curii.com>

diff --git a/charts/arvados/templates/api-server-deployment.yaml b/charts/arvados/templates/api-server-deployment.yaml
index 7b5bb5ce062378c754d5373d95c719553188b5b8..4f90fcaeb5ec5026b60377c02d75665cbe0346d5 100644 (file)
--- a/charts/arvados/templates/api-server-deployment.yaml
+++ b/charts/arvados/templates/api-server-deployment.yaml
@@ -49,6 +49,11 @@ spec:
             - name: api-server-configmap
               mountPath: /etc/nginx/sites-enabled/api-server.conf
               subPath: nginx.conf
+            {{- if .Values.customCABundle }}
+            - name: custom-ca-bundle-volume
+              mountPath: /etc/ssl/certs/ca-certificates.crt
+              subPath: custom-ca-bundle.pem
+            {{- end }}
         - name: arvados-controller
           image: "cure/arvados-runtime"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
@@ -86,3 +91,8 @@ spec:
         - name: nginx-configmap
           configMap:
             name: arvados-api-server-https-configmap
+        {{- if .Values.customCABundle }}
+        - name: custom-ca-bundle-volume
+          configMap:
+            name: custom-ca-bundle-configmap
+        {{- end }}

diff --git a/charts/arvados/templates/api-server-service.yaml b/charts/arvados/templates/api-server-service.yaml
index b1b9e8b04f7974dbd9039b89e2b8e74736809daf..1be78e7a4dc63f0a9d36f0c5eaeec0ac05625f10 100644 (file)
--- a/charts/arvados/templates/api-server-service.yaml
+++ b/charts/arvados/templates/api-server-service.yaml
@@ -11,9 +11,13 @@ metadata:
     chart: {{ template "arvados.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+  annotations:
+    {{- range $key, $value := .Values.loadBalancer.annotations }}
+      {{ $key }}: {{ $value | quote }}
+    {{- end }}
 spec:
   type: LoadBalancer
-  externalTrafficPolicy: Local
+  externalTrafficPolicy: {{ .Values.loadBalancer.apiServerExternalTrafficPolicy }}
   loadBalancerIP: {{ required "A valid externalIP is required!" .Values.externalIP }}
   ports:
   - name: http

diff --git a/charts/arvados/templates/custom-ca-bundle-configmap.yaml b/charts/arvados/templates/custom-ca-bundle-configmap.yaml
new file mode 100644 (file)
index 0000000..580b4d9
--- /dev/null
+++ b/charts/arvados/templates/custom-ca-bundle-configmap.yaml
@@ -0,0 +1,16 @@
+# Copyright (C) The Arvados Authors. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: custom-ca-bundle-configmap
+  labels:
+    app: {{ template "arvados.name" . }}
+    chart: {{ template "arvados.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+data:
+  custom-ca-bundle.pem: |
+{{ .Values.customCABundle | indent 4 }}

diff --git a/charts/arvados/templates/keep-proxy-service.yaml b/charts/arvados/templates/keep-proxy-service.yaml
index 4a3fcff59cef439e98c154e3ed18f767f1307a7f..e1842733b98162efb841361d8ec3ab37b05bc17c 100644 (file)
--- a/charts/arvados/templates/keep-proxy-service.yaml
+++ b/charts/arvados/templates/keep-proxy-service.yaml
@@ -12,6 +12,10 @@ metadata:
     chart: {{ template "arvados.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+  annotations:
+    {{- range $key, $value := .Values.loadBalancer.annotations }}
+      {{ $key }}: {{ $value | quote }}
+    {{- end }}
 spec:
   type: LoadBalancer
   loadBalancerIP: {{ required "A valid externalIP is required!" .Values.externalIP }}

diff --git a/charts/arvados/templates/keep-web-service.yaml b/charts/arvados/templates/keep-web-service.yaml
index 6789e9ba54619b7d8913c98571bccbdd38d594e8..389fbdbf927f57b31455fd35692892dbd66cbe6c 100644 (file)
--- a/charts/arvados/templates/keep-web-service.yaml
+++ b/charts/arvados/templates/keep-web-service.yaml
@@ -12,6 +12,10 @@ metadata:
     chart: {{ template "arvados.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+  annotations:
+    {{- range $key, $value := .Values.loadBalancer.annotations }}
+      {{ $key }}: {{ $value | quote }}
+    {{- end }}
 spec:
   type: LoadBalancer
   loadBalancerIP: {{ required "A valid externalIP is required!" .Values.externalIP }}

diff --git a/charts/arvados/templates/sso-service.yaml b/charts/arvados/templates/sso-service.yaml
index fd9ad1a472ac45df083cbd04404044b3ed3d04bd..31f5e8d6897fc691f8fb0cc0d32cb19bc060b0f0 100644 (file)
--- a/charts/arvados/templates/sso-service.yaml
+++ b/charts/arvados/templates/sso-service.yaml
@@ -11,6 +11,10 @@ metadata:
     chart: {{ template "arvados.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+  annotations:
+    {{- range $key, $value := .Values.loadBalancer.annotations }}
+      {{ $key }}: {{ $value | quote }}
+    {{- end }}
 spec:
   type: LoadBalancer
   loadBalancerIP: {{ required "A valid externalIP is required!" .Values.externalIP }}

diff --git a/charts/arvados/templates/workbench-deployment.yaml b/charts/arvados/templates/workbench-deployment.yaml
index 997fe469a308cb4e6faf06893ac42cacab4da532..e8c506e451c2fdc97300ba4fdf4330facb9f1990 100644 (file)
--- a/charts/arvados/templates/workbench-deployment.yaml
+++ b/charts/arvados/templates/workbench-deployment.yaml
@@ -49,6 +49,11 @@ spec:
             - name: ssl-configmap
               mountPath: /etc/ssl/private/workbench.key
               subPath: key
+            {{- if .Values.customCABundle }}
+            - name: custom-ca-bundle-volume
+              mountPath: /etc/ssl/certs/ca-certificates.crt
+              subPath: custom-ca-bundle.pem
+            {{- end }}
       volumes:
         - name: etc-configmap
           configMap:
@@ -59,3 +64,9 @@ spec:
         - name: ssl-configmap
           configMap:
             name: ssl-configmap
+        {{- if .Values.customCABundle }}
+        - name: custom-ca-bundle-volume
+          configMap:
+            name: custom-ca-bundle-configmap
+        {{- end }}
+

diff --git a/charts/arvados/templates/workbench-service.yaml b/charts/arvados/templates/workbench-service.yaml
index a12aa225dea8bdb0f53120a1cc40f1e139e46018..cd2d9e82d08486c60d1c9e3ebb847b3b220de336 100644 (file)
--- a/charts/arvados/templates/workbench-service.yaml
+++ b/charts/arvados/templates/workbench-service.yaml
@@ -11,6 +11,10 @@ metadata:
     chart: {{ template "arvados.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+  annotations:
+    {{- range $key, $value := .Values.loadBalancer.annotations }}
+      {{ $key }}: {{ $value | quote }}
+    {{- end }}
 spec:
   type: LoadBalancer
   loadBalancerIP: {{ required "A valid externalIP is required!" .Values.externalIP }}

diff --git a/charts/arvados/templates/ws-service.yaml b/charts/arvados/templates/ws-service.yaml
index 8dcf9d2cc27039cfab86c3d34a001a4e31c33f5d..f6978b444870dc911fd5744a120feb234e1d642a 100644 (file)
--- a/charts/arvados/templates/ws-service.yaml
+++ b/charts/arvados/templates/ws-service.yaml
@@ -12,6 +12,10 @@ metadata:
     chart: {{ template "arvados.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+  annotations:
+    {{- range $key, $value := .Values.loadBalancer.annotations }}
+      {{ $key }}: {{ $value | quote }}
+    {{- end }}
 spec:
   type: LoadBalancer
   loadBalancerIP: {{ required "A valid externalIP is required!" .Values.externalIP }}

diff --git a/charts/arvados/values.yaml b/charts/arvados/values.yaml
index 724cfd88b586de3fd3cf335a8e8dd2c6e4b9a1fe..1336eed66a46c08bbe1d4220364c6dba77bf1a50 100644 (file)
--- a/charts/arvados/values.yaml
+++ b/charts/arvados/values.yaml
@@ -13,6 +13,17 @@ image:
 # Must be set to a valid IP address, e.g. by using --set when invoking helm
 externalIP: ~
 
+loadBalancer:
+  # Annotations to add to all LoadBalancer Services.
+  # This is required for MetalLB, since the same externalIP is reused for all
+  # services, and sharing is disabled by default.
+  # metallb.universe.tf/allow-shared-ip: arbitrary-sharing-key
+  annotations:
+
+  # externalTrafficPolicy for the api-server-service
+  # Set to Cluster if using MetalLB, otherwise an externalIP won't be allocated
+  apiServerExternalTrafficPolicy: Local
+
 # The default e-mail address and password for the initial cluster admin user
 adminUserEmail: "test@example.com"
 adminUserPassword: "passw0rd"
@@ -58,3 +69,8 @@ arvados:
       arvados: 2.0.2
       arvadosCLI: 2.0.2
       arvadosLoginSync: 2.0.2
+
+# A custom bundle of CA certificates to use.
+# Useful for corporate networks with TLS proxies.
+# Set it by using the --set-file Helm argument.
+customCABundle: ""